237K+ AI events recorded on our own fleet · last 30 days AI events on our own fleet · 30d
Security & governancePut your AI policies into practice.EngineeringGive developers AI tools with clear rules.LeadershipAdoption, ROI and risk in one view.
Works with Cursor · Claude Code · ChatGPT · GitHub CopilotExplore the platform →
Our approachObserve first, then set rules.Why we built itA note from our founder.InsightureThe team behind Tracelet.
DESIGN PARTNERSShape Tracelet with us.Three months, hands-on, in your cloud. →
SecurityHow Tracelet keeps data in your cloud.Shadow AIHow exposed is your organisation?Real-world incidentsWhen AI actions go wrong.BlogPerspectives on governing AI.FAQAnswers to common questions.

Private by design. Yours to control.

AI governance in your environment, on your terms. Minimal data capture. Clear accountability for every decision.

Explore deployment options
Single tenant · illustrative

Local policy enforcement

On the enrolled machine

Each machine has its own key pair, and the private key never leaves it. Supported file, shell and MCP actions are checked here, before they complete.

Mutual TLS

Private control plane

In your cloud or on premises

Single tenant, in your cloud or data centre. Policies and decision records stay inside your environment.

Single tenant. Inside your boundary.

The control plane is installed single tenant into infrastructure you own, so it lands inside the compliance boundary your security team already reviews.

  • AWS

    Your AWS account

  • Google Cloud

    Your Google Cloud project

  • Azure

    Your Azure subscription

  • On premises

    Your data centre

Inside the compliance boundary you already have.

Tracelet runs inside the controls, network perimeter and audit scope you already maintain. Nothing is sent to us, so there is no new vendor data flow to assess or document.

What is captured, and what is not.

Tracelet records decision context by default. Content capture is opt-in and encrypted, and you set retention and access.

Recorded

Decision contextActor, tool, action, time and policy result

Policy context and data classificationEvaluated on the machine

Not recorded by default

File contentOff by default · organisation opt-in · encrypted at ingest

Prompt contentOff by default · organisation opt-in · encrypted at ingest

  • Control how long it is kept

    Retention is set by data class and agreed during the security review.

    Configurable retention

  • Control who can see it

    Record access is scoped to the people who need it, and is itself reviewable.

    Role-scoped record access

Where Tracelet stands on certification.

Our compliance programme is underway. For how Tracelet supports your own audits, see the governance page.

  • SOC 2 Type IIIn progress.
  • ISO/IEC 42001In progress. Building our AI management system to the standard.
  • ISO 27001Controls aligned to the standard.
  • Internal control standardsMapped together during the security review.

Bring the security, audit and privacy questions your teams will ask.

We walk through these with your security team before a partnership starts. Questions: tracelet@insighture.com.

Become a design partner
  1. 01

    Deployment boundary and data residency

  2. 02

    Machine identity, enrolment and access model

  3. 03

    Policy coverage for your tools and actions

  4. 04

    Capture, retention and record access